Re: [PATCH nf] netfilter: nft_ct: fix OOB in NFT_CT_SRC/DST eval

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 5/28/26 6:24 PM, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> On Thu, May 28, 2026 at 11:31:32AM +0200, Florian Westphal wrote:
>>> Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>>>   type filter hook output priority -300; policy accept;
>>>   ct zone set 1
>>>   ct original saddr 0.0.0.0 counter accept
>>> }
>>>
>>> Then: ping -c 1 127.0.0.1
>>>
>>> should the rule match the template or not?
>> I don't think so, no matching on the template conntrack.
> Great, I will make a test case for nftables.
> Jiayuan, would you send a v2  that fixes the OOB+register leak
> and restricts template matching?
>
> Thanks!

Sure. I will send V2 since everything is clear.